Who Grants the Agent Power? Defending Against Instruction Injection via Task-Centric Access Control

AI agents capable of GUI understanding and Model Context Protocol are increasingly deployed to automate mobile tasks. However, their reliance on over-privileged, static permissions creates a critical vulnerability: instruction injection. Malicious instructions, embedded in otherwise benign content like emails, can hijack the agent to perform unauthorized actions. We present AgentSentry, a lightweight runtime task-centric access control framework that enforces dynamic, task-scoped permissions. Instead of granting broad, persistent permissions, AgentSentry dynamically generates and enforces minimal, temporary policies aligned with the user's specific task (e.g., register for an app), revoking them upon completion. We demonstrate that AgentSentry successfully prevents an instruction injection attack, where an agent is tricked into forwarding private emails, while allowing the legitimate task to complete. Our approach highlights the urgent need for intent-aligned security models to safely govern the next generation of autonomous agents.

Key Contributions

• Formalizes the threat model for multimodal indirect instruction injection against AI agents operating on unmodified mobile OSes
• Proposes Task-Centric Access Control as a security paradigm: dynamic, minimal, temporary permissions scoped to the user's specific task
• Presents AgentSentry, a lightweight runtime framework that prevents instruction injection (email exfiltration) while completing legitimate tasks unimpeded

🛡️ Threat Analysis

Details

Similar Papers